Attackers used Cairn, an open-source AI penetration testing framework, to run 25 operations against at least 19 organizations in August and September 2026, Palo Alto Networks’ Unit 42 said in a report published November 12. The operations ran on Chinese models from Zhipu and DeepSeek and achieved unauthorized access or data retrieval at 10 of them.
Unit 42 tracks the activity as CL-STA-1238 and assesses with moderate confidence that it is China-nexus intelligence collection. It cites tasking instructions and authorization files written in Chinese, the attackers’ exclusive use of Chinese models, and a target list it says aligns with established Chinese state intelligence priorities. The report does not name the victims.
Seven of the targeted organizations are in the semiconductor and advanced-manufacturing supply chain, spanning lithography, chip design, materials, photomasks and standards. Three work in defense and defense policy, including a space technology company and a policy think tank. Four are human rights and civil society groups, including a Canadian human rights body and a U.S. teachers’ union.
At an industry standards organization, password spraying yielded dozens of valid credentials, and the attackers overwrote a live standards-ballot document through an unauthenticated cloud storage write. At a semiconductor company, they brute-forced a production credential on a partner integration application, then created unauthorized administrator accounts and a persistent API token. At the teachers’ union, the framework logged access to more than one million member records, roughly 31,000 CRM contacts and staff password hashes. An identity platform supporting a defense policy program exposed roughly 500 user records, including accounts on .mil and .gov domains.
For each operation, the attackers created a task with a one-line goal in Chinese and seeded it with the organization’s root domain. Unit 42 translated one goal as “Obtain substantive high-value access, including but not limited to webshell, SSH, source code, keys, user information, credentials, ideally, to enter the internal network.” A task against a semiconductor equipment supplier also included VPN gateway addresses, group names and shared group passwords, which Unit 42 says the attackers had gathered beforehand.
The AI model planned three to seven stages for each target, and Cairn worked through the resulting tasks in a loop while operators could inject “hints” at any time. Operations ran from 20 minutes to more than 50 hours.
Thirteen of the 25 operations ran on Zhipu’s GLM-5.2, an open-weight model whose successor’s weights the company held back over its cyber capabilities. Eight ran on DeepSeek V4 Flash and four on DeepSeek V4 Pro, which Unit 42 says the attackers appear to have used for repeat attempts against targets that resisted Flash.
Unit 42 says Cairn’s stock prompts already tell the model never to refuse a task. The attackers added a Chinese-language preamble to the prompt sent at every reasoning and exploration step, declaring all tasks authorized and forbidding refusal. “Neither Zhipu GLM nor DeepSeek refused this framing,” Unit 42 wrote.
The attackers ran a customized fork of Cairn from a Hong Kong server, with a U.S. staging node, and loaded a scanning and exploitation skill pack not found in the public project. The weaknesses exploited were known ones, the report says, including authentication bypasses, weak and default credentials, exposed cloud APIs and dated public CVEs. “Autonomous AI raises the volume and coverage of exploitation, but not its complexity,” it concludes.
On November 11, CloudSEK described a Silent Lynx operator tasking a DeepSeek-powered agent against Tajik networks. CrowdStrike has said a China-nexus group used ARTEX, another autonomous penetration testing framework, against more than 200 organizations. Palo Alto Networks said it shared the findings with other Cyber Threat Alliance members.
Sources: Unit 42
–
By the Control Plane Editorial Team